Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Removed v1 details from the docs and updated to v2 zowe.yaml descript… #3817

Merged
merged 8 commits into from
Aug 22, 2024
4 changes: 2 additions & 2 deletions docs/troubleshoot/troubleshoot-apiml.md
Original file line number Diff line number Diff line change
Expand Up @@ -342,9 +342,9 @@ Fix the missing z/OSMF host name in subject alternative names using the followin
**Follow these steps:**

1. Re-create the Zowe keystore by deleting it and re-creating it.
2. In the `zowe-setup-certificates.env` file that is used to generate the keystore, ensure that the property `VERIFY_CERTIFICATES` and `NONSTRICT_VERIFY_CERTIFICATES` are set to `false`.
2. In the `zowe.yanl` file that used to launch Zowe, ensure the property `zowe.verifyCertificates` is set to `DISABLED` or `NONSTRICT`. The default value is `STRICT` which ensures that Zowe will validate the certificate authority's signing chain is trusted, as well as the IP address for Zowe's servers match the certificate's subject alternative name.
Copy link
Collaborator

@skurnevich skurnevich Aug 16, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Minor typo here 'yanl', but apart of that, looks good to me

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed


**Important!** Disabling `VERIFY_CERTIFICATES` or `NONSTRICT_VERIFY_CERTIFICATES` may expose your server to security risks. Ensure that you contact your system administrator before disabling these certificates and use these options only for troubleshooting purposes.
**Important!** Disabling `zowe.verifyCertificates` may expose your server to security risks. Ensure that you contact your system administrator before disabling these certificates and use these options only for troubleshooting purposes.

#### Invalid z/OSMF host name in subject alternative names

Expand Down
2 changes: 1 addition & 1 deletion docs/user-guide/import-certificates.md
Original file line number Diff line number Diff line change
Expand Up @@ -69,7 +69,7 @@ Trust in the API ML server is a necessary precondition for secure communication
If a SAF keyring is used and set up with `ZWEKRING` JCL, the procedure to obtain the certificate does not apply. In this case, we recommended that you work with your security system administrator to obtain the certificate.
:::

The public certificate in [PEM format](https://en.wikipedia.org/wiki/Privacy-Enhanced_Mail) is stored at `<KEYSTORE_DIRECTORY>/local_ca/localca.cer` where `<KEYSTORE_DIRECTORY>` is defined in a customized `<RUNTIME_DIR>/bin/zowe-setup-certificates.env` file during the installation step that generates Zowe certificates. The certificate is stored in UTF-8 encoding so you need to transfer it as a binary file. Since this is the certificate to be trusted by your browser, it is recommended to use a secure connection for transfer.
The public certificate in [PEM format](https://en.wikipedia.org/wiki/Privacy-Enhanced_Mail) is stored in a USS directory a defined in the `zowe.yaml` configuration file at section `zowe.certificate.pem.certificateAuthorities` . The certificate is stored in UTF-8 encoding so you need to transfer it as a binary file. Since this is the certificate to be trusted by your browser, it is recommended to use a secure connection for transfer.

:::note
Windows currently does not recognize the PEM format. For Windows, use the P12 version of the `local_cer`.
Expand Down
Loading